Renovate updates

[amitsingh-007]

Check if the Pull Request fulfils these requirements

• Does the extension require a version change?

• Resolves all 2 issues in @grpc/grpc-js
• Resolves 1/3 issues in protobufjs
• Resolves CVE-2026-12143 — form-data: Form field override via CRLF injection
• Resolves 1/2 issues in websocket-driver

Greptile Summary

The PR updates application, build, and CI dependencies while preserving the CommonJS-compatible jose override required by Firebase Admin authentication.

• Upgrades Firebase, Next.js, React, WXT, Vercel, and supporting tooling.
• Updates GitHub Actions and release automation versions.
• Protects the jwks-rsa>jose compatibility override from Renovate updates.
• Removes obsolete React Compiler lint suppressions.

Confidence Score: 5/5

The PR appears safe to merge.

The previously reported authentication failure is fixed: the workspace override remains in place, the lockfile resolves jwks-rsa to the CommonJS-compatible jose@4.15.9, and Renovate is prevented from updating that override, so no blocking failure remains.

_{Reviews (2): Last reviewed commit: "fix: restore jose 4.15.9 pin under jwks-..." | Re-trigger Greptile}

Context used:

• Knowledge Base — packages/trpc: shared tRPC API layer

[webext-bot]

Extension version is updated from 25.0.0 to 25.1.0

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

Fixed security issues:

• @grpc/grpc-js (link) · Dashboard

• form-data (link) · Dashboard

• postcss (link)

• protobufjs (link) · Dashboard

• sharp (link)

• websocket-driver (link) · Dashboard

• The comment above the jwks-rsa>jose override still refers to the dual CJS/ESM 4.15.9 workaround, but the override now targets 6.2.4; update the comment to reflect the new rationale or confirm this workaround is still needed with the newer jose version.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The comment above the `jwks-rsa>jose` override still refers to the dual CJS/ESM 4.15.9 workaround, but the override now targets 6.2.4; update the comment to reflect the new rationale or confirm this workaround is still needed with the newer jose version.

## Individual Comments

### Comment 1
<location path="pnpm-workspace.yaml" line_range="9-10" />
<code_context>
       version: 5.0.14

 overrides:
-  jwks-rsa>jose: 4.15.9
+  jwks-rsa>jose: 6.2.4

 importers:
</code_context>
<issue_to_address>
**issue (bug_risk):** The jose override version no longer matches the explanatory comment and may no longer be API-identical.

The override comment still references jose 4.15.9 as API-identical for importJWK/exportSPKI and tied to specific upstream issues, but the override is now 6.2.4. Please either (a) verify that jwks-rsa behaves correctly with jose 6.x for these APIs in this usage, or (b) update/remove the comment so it accurately explains why we pin 6.2.4. As-is, the mismatch between the pinned version and the comment could be misleading and hide potential compatibility issues.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[amitsingh-007]

@greptile review